EC2 Windows - 獲取管理員密碼

Question

目前，我知道從新創建的EC2 Windows實例中檢索管理員密碼的唯一方法是通過AWS管理控制檯。這很好，但我需要知道如何通過Java API實現這一點 - 我似乎無法找到有關該主題的任何內容。另外，一旦獲得，我該如何使用相同的API修改密碼？

感謝，

約翰尼

Answer 1

您可以創建一個實例，設置密碼，然後再將其轉換成圖像。爲您創建的每個實例有效設置默認密碼。這不是更簡單嗎？

Answer 2

看起來你正在尋找的API的以下部分：GetPasswordDataRequest和GetPasswordDataResult

Answer 3

的EC2 API有一個叫「GetPasswordData」你可以用它來檢索包含管理員密碼數據的加密塊。要解密它，你需要2件東西：

一，私鑰。這是您用於實例化實例的密鑰對的私有一半。通常情況下，Amazon使用PEM格式的密鑰（「----- BEGIN」...），但Java Crypto API需要DER格式的密鑰。你可以自己完成轉換 - 剝離----- BEGIN和----- END行，將中間的文本塊和base64解碼。

二，加密參數。對數據進行加密與RSA，與PKCS1填充 - 如此神奇的調用，送給JCE是：Cipher.getInstance("RSA/NONE/PKCS1Padding")

這裏有一個完整的例子（依靠BouncyCastle的，但是可以修改爲使用不同的加密引擎）

package uk.co.frontiertown; 

import com.amazonaws.auth.AWSCredentials; 
import com.amazonaws.auth.BasicAWSCredentials; 
import com.amazonaws.services.ec2.AmazonEC2Client; 
import com.amazonaws.services.ec2.model.GetPasswordDataRequest; 
import com.amazonaws.services.ec2.model.GetPasswordDataResult; 
import org.bouncycastle.jce.provider.BouncyCastleProvider; 
import org.bouncycastle.util.encoders.Base64; 

import javax.crypto.Cipher; 
import java.nio.charset.Charset; 
import java.security.GeneralSecurityException; 
import java.security.KeyFactory; 
import java.security.PrivateKey; 
import java.security.Security; 
import java.security.spec.PKCS8EncodedKeySpec; 

public class GetEc2WindowsAdministratorPassword { 

    private static final String ACCESS_KEY = "xxxxxxxxxxxxxxxxxxxx"; 
    private static final String SECRET_KEY = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; 
    private static final String PRIVATE_KEY_MATERIAL = "-----BEGIN RSA PRIVATE KEY-----\n" + 
     "MIIEowIBAAKCAQEAjdD54kJ88GxkeRc96EQPL4h8c/7V2Q2QY5VUiJ+EblEdcVnADRa12qkohT4I\n" + 
     // several more lines of key data 
     "srz+xXTvbjIJ6RL/FDqF8lvWEvb8uSC7GeCMHTznkicwUs0WiFax2AcK3xjgtgQXMgoP\n" + 
     "-----END RSA PRIVATE KEY-----\n"; 

    public static void main(String[] args) throws GeneralSecurityException, InterruptedException { 
     Security.addProvider(new BouncyCastleProvider()); 
     String password = getPassword(ACCESS_KEY, SECRET_KEY, "i-XXXXXXXX", PRIVATE_KEY_MATERIAL); 
     System.out.println(password); 
    } 

    private static String getPassword(String accessKey, String secretKey, String instanceId, String privateKeyMaterial) throws GeneralSecurityException, InterruptedException { 

     // Convert the private key in PEM format to DER format, which JCE can understand 
     privateKeyMaterial = privateKeyMaterial.replace("-----BEGIN RSA PRIVATE KEY-----\n", ""); 
     privateKeyMaterial = privateKeyMaterial.replace("-----END RSA PRIVATE KEY-----", ""); 
     byte[] der = Base64.decode(privateKeyMaterial); 
     PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(der); 
     KeyFactory keyFactory = KeyFactory.getInstance("RSA"); 
     PrivateKey privateKey = keyFactory.generatePrivate(keySpec); 

     // Get the encrypted password data from EC2 
     AWSCredentials awsCredentials = new BasicAWSCredentials(accessKey, secretKey); 
     AmazonEC2Client client = new AmazonEC2Client(awsCredentials); 
     GetPasswordDataRequest getPasswordDataRequest = new GetPasswordDataRequest().withInstanceId(instanceId); 
     GetPasswordDataResult getPasswordDataResult = client.getPasswordData(getPasswordDataRequest); 
     String passwordData = getPasswordDataResult.getPasswordData(); 
     while (passwordData == null || passwordData.isEmpty()) { 
      System.out.println("No password data - probably not generated yet - waiting and retrying"); 
      Thread.sleep(10000); 
      getPasswordDataResult = client.getPasswordData(getPasswordDataRequest); 
      passwordData = getPasswordDataResult.getPasswordData(); 
     } 

     // Decrypt the password 
     Cipher cipher = Cipher.getInstance("RSA/NONE/PKCS1Padding"); 
     cipher.init(Cipher.DECRYPT_MODE, privateKey); 
     byte[] cipherText = Base64.decode(passwordData); 
     byte[] plainText = cipher.doFinal(cipherText); 
     String password = new String(plainText, Charset.forName("ASCII")); 

     return password; 
    } 
} 

ObDisclosure：我本來回答了這個博客上張貼在http://www.frontiertown.co.uk/2012/03/java-administrator-password-windows-ec2-instance/

Answer 4

你也可以創建默認的用戶名和密碼設置上Image.And一個圖像，然後啓動所有實例與圖像id..so那你不需要創建和檢索密碼evry time..just啓動你的insta nce rdp，它在Image中啓動了帶有definde credious的實例。我也是這樣做的，而且完全爲我工作。